Additional fixes: longstanding bug misunderstanding palette start offset.

We were misunderstanding the role of the palette "start" index.
Pixel values are absolute, not relative to the start index.

Signed-off-by: Larry Gritz <lg@larrygritz.com>

Author: lgritz

src/targa.imageio/targa_pvt.h

@@ -34,9 +34,9 @@ typedef struct {
     uint8_t idlen;         ///< image comment length
     uint8_t cmap_type;     ///< palette type
     uint8_t type;          ///< image type (see tga_image_type)
-    uint16_t cmap_first;   ///< offset to first entry
-    uint16_t cmap_length;  ///<
-    uint8_t cmap_size;     ///< palette size
+    uint16_t cmap_first;   ///< offset to first stored color entry
+    uint16_t cmap_length;  ///< number of stored color map entries
+    uint8_t cmap_size;     ///< bits per palette entry: 15, 16, 24, or 32
     uint16_t x_origin;     ///<
     uint16_t y_origin;     ///<
     uint16_t width;        ///< image width

src/targa.imageio/targainput.cpp

@@ -584,11 +584,13 @@ TGAInput::decode_pixel(unsigned char* in, unsigned char* out,
     case TYPE_PALETTED_RLE:
         for (int i = 0; i < bytespp; ++i)
             k |= in[i] << (8 * i);  // Assemble it in little endian order
-        k = (m_tga.cmap_first + k) * uint64_t(palbytespp);
-        if (k + palbytespp > palette_alloc_size) {
+        if (k < m_tga.cmap_first || k >= m_tga.cmap_first + m_tga.cmap_length) {
             errorfmt("Corrupt palette index");
             return false;
         }
+        // The palette indices stored in the file's pixels are absolute, so
+        // subtract the start offset to correctly index from the palette.
+        k = (k - m_tga.cmap_first) * uint64_t(palbytespp);
         switch (palbytespp) {
         case 2:
             // see the comment for 16bpp RGB below for an explanation of this